Privacy Policy

This policy explains what personal data we collect when you use Tavle, why we collect it, and the rights you have over it.

1. Who is responsible for your data

The controller of the personal data described in this policy is [Company legal name], [registered address], company registration number [company registration number]. You can reach us about privacy at [contact email address].

Section 9 explains the separate situation where we handle data on behalf of a customer rather than for our own purposes.

2. What we collect

• Account data — your name, email address, the company or workspace you belong to, and your role in it.
• Authentication data — the sign-in links we issue and records of when they were used, which we need to keep sign-in secure.
• Usage and technical data — log records such as IP address, browser and device information, pages viewed and actions taken in the service, and diagnostic data when something goes wrong.
• Connected data — the data Tavle reads from the integrations you choose to connect, together with the credentials or tokens needed to reach them. This is usually business data, but it can contain personal data depending on the integration.
• Billing data — the details needed to invoice a paid plan. Card details are handled by our payment provider and are not stored by us.
• Communications — messages you send us through the contact form, by email or in support conversations.

3. Why we use it, and on what lawful basis

• To provide the service — creating and administering your account, connecting your integrations and displaying your boards. Lawful basis: performance of a contract.
• To bill and account for paid plans — invoicing, payment handling and bookkeeping. Lawful basis: performance of a contract, and compliance with a legal obligation for accounting records.
• To keep the service secure and reliable — detecting abuse, preventing unauthorised access, monitoring and debugging. Lawful basis: our legitimate interest in a secure and functioning service.
• To support and communicate with you — answering your messages and sending service notices about changes, incidents or terms. Lawful basis: performance of a contract and our legitimate interest in administering it.
• To improve the product — understanding in aggregate how the service is used so we can develop it. Lawful basis: our legitimate interest in improving what we offer.
• To send marketing messages — where we do this, it is on the basis of your consent, or of an existing customer relationship where the law allows it. You can opt out at any time. Lawful basis: consent or legitimate interest.
• To meet legal obligations and defend legal claims — Lawful basis: compliance with a legal obligation, and our legitimate interest in establishing or defending claims.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, and you can object as described in section 10.

4. Cookies and similar technologies

We use cookies that are strictly necessary to run the service — keeping you signed in, protecting the sign-in form against automated abuse, and remembering security-related preferences. Our sign-in page includes a bot-protection widget supplied by a third party, which sets its own strictly necessary cookie. If we introduce cookies that are not strictly necessary, such as analytics or advertising cookies, we will ask for your consent first and give you a way to withdraw it.

5. Who we share it with

We do not sell personal data. We share it only with:

• service providers who process data on our instructions under a written data processing agreement — categories include hosting and infrastructure, email delivery, payment processing, error tracking and customer support tooling;
• the providers of the integrations you connect, to the extent needed to read the data you have asked us to read;
• professional advisers, and public authorities where we are legally required to disclose;
• a buyer or successor, if the business is reorganised, merged or sold, in which case this policy continues to apply to the data transferred.

A current list of the sub-processors we use is available on request from [contact email address].

6. International transfers

Some of our providers may process data outside the European Economic Area. Where that happens, we rely on a lawful transfer mechanism — an adequacy decision, or standard contractual clauses together with any additional safeguards the transfer requires. You can ask us for details of the mechanism used for a particular transfer.

7. How long we keep it

We keep personal data only for as long as we need it for the purposes above. In practice that means we keep account data for as long as your account is active and for a period afterwards while claims may still arise; we keep billing records for as long as accounting and tax law requires; we keep security and diagnostic logs for a short period proportionate to their purpose; and we delete or anonymise data connected to a workspace after the workspace is closed. We can tell you the retention period that applies to a specific category of data on request.

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control on a need-to-know basis, passwordless sign-in, logging, and regular updates of the software we run. No service can be completely secure, and we will notify you and the relevant authority of a personal data breach where the law requires it.

9. Data you bring into Tavle

When you connect an integration, Tavle reads data from it on your instructions. If that data contains personal data — for example the names of your customers or employees — you are the controller of it and we act as your processor. We process it only to provide the service, under our agreement with you, and we make a data processing agreement available covering the terms the law requires. Requests from the individuals concerned should be addressed to you as controller; we will assist you in answering them.

10. Your rights

In relation to the personal data we hold about you as controller, you have the right to:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have your data deleted where one of the grounds in the law applies.
• Restriction — ask us to limit how we use your data while a question about it is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
• Objection — object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time, without affecting processing carried out before you did.

To exercise any of these, write to [contact email address]. We will respond within the time the law allows, and we may need to verify your identity first. If you believe we have handled your data unlawfully, you also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work — though we would be glad of the chance to resolve it with you first.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not use your personal data for profiling of that kind.

12. Children

Tavle is a tool for businesses and is not directed to children. We do not knowingly collect personal data from them, and we will delete it if we learn that we have.

13. Changes to this policy

We will post any updated version of this policy here with a new "last updated" date, and we will tell you in advance about changes that materially affect how we use your personal data.

14. Contact

[Company legal name], [registered address]. Privacy questions and rights requests can go to [contact email address], or through our contact page. See also our Terms of Service.